AWS Secrets Manager
It lets you store secrets (passwords, API keys, …) in a secure way. It’s usable via console, CLI, API or SDK.
Secrets Manager has similar functionality as SSM Parameter Store, but it adds more:
-
Automatic rotation of secrets using Lambda: a function is periodically invoked and rotates the secret but you need to manage the rotation inside the services that use the secret.
-
Managed rotation, where Secrets Manager also updates values in the service for the following services:
-
RDS: master user credentials.
-
Aurora: master user credentials.
-
ECS: for the rotation of the AWS Private CA TLS certificates.
-
Redshift: admin passwords.
-
What really makes it different from SSM Parameter Store is that it also focuses on secrets rotation, either via Lambda or with a direct integration.
It works with KMS, so permissions must also be granted for KMS keys.